The essentials in 5 points
- Every targeted attack begins with a passive reconnaissance phase: reading what you expose, without touching your systems.
- This phase triggers no alert. It plays out in already-public data: breaches, certificate logs, metadata, profiles.
- A single published document can leak usernames, software, and internal paths through its metadata.
- AI does not create new exposure, it industrializes the collection and correlation of what is already visible.
- Five internal checks are enough to take a first measure of your surface, before any external audit.
The short answer
What attackers see about your company is everything you publish without thinking about it: email addresses recovered from old breaches, subdomains listed in certificate logs, the metadata of a PDF you put online, your teams’ public profiles, hints about your hosting. This collection is called passive reconnaissance. It never touches your information system, so it triggers no alert, and it is the first step of nearly every targeted attack.
The good news: this surface can be measured. The same open sources attackers use are available to a defender. Five internal checks give a first snapshot of what you expose, and an external surface audit completes the picture when the stakes justify it. The rest of this article details what is visible, why AI makes this phase faster, and where to start.
Passive reconnaissance: seeing without being seen
An attack almost never begins with an intrusion. It begins with reading. Before sending a single packet toward your servers, a methodical attacker builds a map of your organization from entirely public sources. This is OSINT (open source intelligence): intelligence drawn from open sources.
From the attacker’s standpoint, the appeal of this phase is one word: stealth. Consulting a certificate log, downloading a document already online, or querying a public breach database leaves no trace in your logs. You cannot detect reconnaissance you are not directly subjected to. That is exactly what makes it effective, and what justifies handling it upstream rather than waiting for the signal of an intrusion.
One point deserves to be stated without drama: passive reconnaissance compromises nothing on its own. It prepares the ground. But the quality of that preparation often determines what follows. A credible phishing message, a guessed password, a targeted administration service: all of it builds on what was gathered beforehand.
What is visible without ever touching your systems
Your teams’ public profiles. A single username is often enough to find one person’s accounts across dozens of platforms. Public, documented tools sweep several hundred networks from a single handle. Cross-referenced with an org chart reconstructed from professional networks, these profiles reveal who does what, who decides, and who would be the most profitable target for spear phishing.
Your addresses in data breaches. Credential breaches accumulate and get recompiled. A work address that appeared in an old breach stays usable years later, especially if the associated password was reused. An attacker cross-references these databases with your domain name to obtain, in seconds, a list of valid addresses and sometimes candidate passwords.
Your subdomains. Every TLS certificate issued for one of your services is recorded in public, permanent logs. These logs, designed for transparency, also list your subdomains, including the ones you thought were discreet: test environments, admin interfaces, old services never taken down. A forgotten but still-online service is a classic entry point.
Your infrastructure fingerprint. The icon shown in the browser tab (the favicon) has a digital fingerprint. That same fingerprint, searched at internet scale, links together servers that share the same configuration, hence often the same organization. It is a public correlation technique that helps trace an infrastructure even when it is spread across several addresses.
Your documents’ metadata. A PDF, a slide deck, or an image published on your site often carries metadata invisible to the reader: the author’s name and therefore an internal identifier, the software and its version, sometimes the file path on the originating machine. These fragments, harmless in isolation, reveal your tools, your naming conventions, and your internal organization.
Why AI speeds up this phase
The exposure described above is nothing new. What changes in 2026 is the speed and scale at which it is exploited. Reconnaissance was historically an analyst’s job: slow, manual, reserved for patient and well-equipped attackers. Tying a handle to a real identity, matching a breach to an org chart, sorting several hundred subdomains to find the vulnerable service, all of that took hours.
AI industrializes this cross-referencing. An investigation agent chains collections together, normalizes heterogeneous sources, and correlates signals continuously, without fatigue and at scale. For a leader, the consequence is not that a new flaw appears, it is that targeted reconnaissance stops being a luxury reserved for a few adversaries. It becomes routine processing, applicable to a large number of organizations in parallel. The surface you already exposed is now read faster, more often, and more systematically.
The five checks to run yourself
- Search your domains in breach databases. List the addresses of your organization present in public breach compilations. Any address found calls at minimum for a password rotation and the activation of two-factor authentication.
- List your subdomains through certificate logs. Certificate transparency logs are public and queryable. Compare the resulting list to your real inventory: every subdomain you do not recognize, or believed decommissioned, deserves a check.
- Inspect the metadata of your public documents. Take a few PDFs and slide decks that are online and examine their properties. If usernames, software versions, or internal paths appear, put a systematic cleanup in place before publication.
- Review the exposure of your key profiles. For your leaders and technical administrators, measure what a third party can reconstruct: role, affiliations, addresses, secondary accounts. The goal is not to disappear, but to know what is legible.
- Spot your exposed administration services. Identify the admin interfaces, remote accesses, and dashboards reachable from the internet. Anything that does not need to be public should sit behind restricted access.
When to move to an external surface audit
These internal checks give a first measure, not a complete map. When they reveal a wider surface than anticipated, or ahead of an exposing event (launch of new services, funding round, rapid team growth), an external surface audit takes over. It maps exposure systematically, separates the residual from the critical, and produces a prioritized list of fixes. Because it relies on already-public data, it runs without ever interrupting your production.
Colombani.ai carries out this kind of AI security audit (external surface mapping, agent-assisted penetration testing, covered by professional liability insurance dedicated to penetration testing) and trains technical teams through the AI agent security course (reconnaissance, OWASP LLM Top 10, red teaming), Qualiopi-certified and eligible for OPCO funding.